feat: 完善知识库、策略预览与OnlyOffice集成

## 配置与环境
- .env.example: 更新环境变量配置
- docker-compose.yml: 完善Docker编排配置
- docker/README.md: 更新Docker文档

## 后端知识库模块
- endpoints/knowledge.py: 增强知识库API端点
- schemas/knowledge.py: 扩展知识库数据模型
- services/knowledge.py: 完善知识库业务逻辑
- config.py: 优化配置管理
- storage/knowledge/.index.json: 更新知识库索引

## 前端功能
- api.js: 完善API服务层
- knowledge.js: 优化知识库服务
- onlyoffice.js: 新增OnlyOffice文档服务集成
- TopBar.vue: 优化顶部导航栏
- PoliciesView.vue: 完善策略视图
- AppShellRouteView.vue: 新增应用外壳路由视图
- views/scripts/PoliciesView.js: 优化策略脚本
- policiesPreviewFormatters.js: 新增策略预览格式化工具

## 样式
- policies-view.css: 完善策略页样式

## 测试
- api-request.test.mjs: API请求测试
- onlyoffice-service.test.mjs: OnlyOffice服务测试
- policies-preview-formatters.test.mjs: 策略预览格式化测试

docker/README.md

@@ -20,6 +20,7 @@ http://<your-linux-host>:5173
 ## Container Layout
 
 - `main`: web + FastAPI main container
+- `onlyoffice`: ONLYOFFICE Document Server
 - `postgres`: PostgreSQL database container
 
 The project root is mounted directly into the main container:
@@ -51,6 +52,7 @@ The PostgreSQL data directory is stored in the named volume `postgres_data`.
   - `POSTGRES_PORT=5432`
   - `DATABASE_URL=...@postgres:...`
 - PostgreSQL is also published to the host by default as `127.0.0.1:55432`.
+- ONLYOFFICE is published to the host by default as `127.0.0.1:8082`.
 - First boot with `SETUP_COMPLETED=false` starts the setup UI only.
 - After you complete setup in the browser, the Vite setup bridge will start FastAPI in the
   same container using the saved runtime configuration.
@@ -59,5 +61,7 @@ The PostgreSQL data directory is stored in the named volume `postgres_data`.
 - If you access the system from another machine, make sure `CORS_ORIGINS` in `.env` includes
   the frontend address you actually use.
 - For Navicat or any host-side client, use `127.0.0.1:55432`.
+- If you need to access ONLYOFFICE from another machine, override `ONLYOFFICE_PUBLIC_URL`
+  so the browser can reach the document server address you actually expose.
 - For the setup page, using `127.0.0.1` is acceptable in this Docker layout; the internal
   test bridge will resolve that back to the Docker PostgreSQL service.